架構一個以角色為金鑰管理基礎的企業數位版權管理

Abstract

企業在走向intranet及extranet之後，資訊安全問題也更形重要。近年來電腦網路被入侵、資料被竄改的情事在國內外不斷地發生。而企業中某些重要資料如生產技術、設計文件、配方等的資訊，更關係到一個企業的營運機密，對於這些資訊的管理，如何防止外洩已成一個重要的課題。而一般網路系統以帳號與通行碼(password)方式來確認使用者身份，並賦予其執行權的設計，已不足以應付現代軟體、文件的使用權限管理，故數位權利管理(Digital Rights Management，DRM)的軟體，也因此孕育而生。在結合了對執行權管制與使用監督的功能後，使得企業的IT部門對於資訊的管理更加完善。然而一般DRM系統其作為加密管制的對象，除了資訊系統硬體外，通常也包含了工號等識別碼，以人或設備為主體而對應執行權的方式常在政策或人員異動時造成管理人員很大的困擾，這些權限更改動作，對於人事更動頻繁公司的IT部門來說，是頗為繁雜的工作。 因此作者思考導入DRM於企業中，其可能遭遇複雜的解密金鑰管理問題，並試著提出一個以RBAC為基礎的金鑰管理架構，研究在企業資訊服務架構上，引進RBAC模組用於DRM系統的加密金鑰管理上，檔案的存取權限是經由所屬角色來決定，而非以機器指紋或員工工號作存取控管的要素，解決企業DRM系統應用上，因人事變動或設備更換所帶來的不變，期能解決企業重要文件管控的問題。並實作一個DRM雛型系統以驗證此研究架構的可行性。

Nowadays, the constant occurrences of hackers’ intrusion into enterprise networks tell us that information security is much more important than ever before. Preventing enterprises from leaking critical information is an important issue. In general information systems, user authentication and access control use identification numbers (IDs) and passwords. This traditional approach is not sufficient to protect modern digital contents. Recently, Digital Rights Management (DRM) software was developed to meet the demand. The DRM systems use IDs and hardware devices to encrypt digital contents and control access from users. This demands a mapping from the devices and IDs to various access rights. Such a mapping needs frequent changes when an enterprise changes policies on information access or employees join or leave the company. In this paper, the author utilizes cryptographic keys to encrypt and decrypt information contents, but proposes a key management scheme based upon the Role Based Access Control paradigm. As a result, the access rights of information contents do not depend on devices or IDs; access rights are determined by the role that an employee act. With this new approach, the management of access rights becomes much easier. The author also implements the idea in a prototype system.